stevejenkins / hardwarefreak.com-fqrdns.pcre

Archive copy of Stan Hoeppner's Postfix PCRE bot spam killer (fqrdns.pcre)
MIT License
26 stars 9 forks source link

Overhead? #15

Closed getgray closed 7 years ago

getgray commented 7 years ago

Steve: Thanks for taking on the maintenance of this. Not really an issue per se, Just a concern. Hopefully it's an OK place to ask. Those pcre files are pretty lengthy. Is there much overhead in applying them to every message that comes through?

stevejenkins commented 7 years ago

Hi @getgray. Good question. Postfix's PCRE implementation is extremely efficient. In fact, even more efficient in most cases than a regexp comparison. See:

http://www.postfix.org/PCRE_README.html

From that doc:

The optional "pcre" map type allows you to specify regular expressions with the PERL style notation such as \s for space and \S for non-space. The main benefit, however, is that pcre lookups are often faster than regexp lookups. This is because the pcre implementation is often more efficient than the POSIX regular expression implementation that you find on many systems.

and

When Postfix searches a pcre: or regexp: lookup table, each pattern is applied to the entire input string. Depending on the application, that string is an entire client hostname, an entire client IP address, or an entire mail address. Thus, no parent domain or parent network search is done, "user@domain" mail addresses are not broken up into their user and domain constituent parts, and "user+foo" is not broken up into user and foo.

The PCRE files are loaded into memory, and the time (and computing power) it takes to do the pattern comparisons is minimal. I'd suggest watching your mail log in realtime with:

tail -f /var/log/maillog

to see just how quickly the patterns match.

I've never had a performance issue, and have never had one reported. Give it a try and see for yourself! :)